Version identification: Binaries of release v0.2.0 report version 0.1.0 (for example in --version output and in the MCP server information). Treat a build that reports 0.1.0 as affected; builds reporting 0.1.0 that predate release v0.2.0 were not assessed and must not be assumed unaffected.
When indexing a nested archive, the name of a TAR archive member was used unchanged as the write path inside the temporary extraction directory. A member name containing parent-directory components or an absolute path could place the extracted file outside that directory.
A crafted archive in an indexed repository could make the server write attacker-controlled content to a path outside the extraction directory, with the permissions of the account running CodeIndexer. The target file name had to end in a recognised archive extension, which keeps the issue short of an arbitrary file overwrite. A related variant in RAR handling could read files outside the temporary directory on Unix hosts where unrar is installed.
Archive indexing — extraction of nested archives during indexing.
Source modules:
src/indexer/archive.rs, src/indexer/indexing.rs
Upgrade to CodeIndexer v0.12.0 or later. No alternative workaround is documented.
First fixed version: v0.7.0. Recommended upgrade: v0.12.0 or later, which includes the fixes for every advisory currently published in this collection.
v0.7.0 sanitises archive member names component by component, canonicalises extracted RAR paths and checks that they stay inside the extraction directory, and validates project names in the index and reindex entry points.
First affected version: v0.2.0 (release-tag commit).
Fix committed (3f2e08762753).
First fixed version: v0.7.0 (release-tag commit).
Advisory published.
Dates come from the project’s git history: fixes by their commit date, versions by the date of the commit their release tag points to — not necessarily the day a build became available for download.
3f2e08762753
2026-04-22
Archive member names sanitised; extracted paths contained to the extraction directory.
CodeIndexer is proprietary software. Commit references identify internal development history and correlate this advisory with our security-review evidence. Their publication does not make the proprietary source code public.
Questions about this advisory, or a new vulnerability to report: email [email protected] or open a private advisory on GitHub. See our security policy for the full disclosure process.
We use a couple of small first-party cookies to keep the site working and remember your theme preference. No tracking, no ads. Learn more.